关于服务器被入侵，AI杀毒的解决办法

{"type":"doc","content":[{"type":"heading","attrs":{"id":"aa652847-974a-4022-998b-1823d52fc1fc","textAlign":"inherit","indent":0,"level":1,"isHoverDragHandle":false},"content":[{"type":"text","text":"写在前面"}]},{"type":"paragraph","attrs":{"id":"71c266a1-de47-4545-a397-0f9a297b79e4","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"我是一名代码爱好者，建站小白，15年开始建站，期间建站无数。4年前，我小轻论坛PC6，移动5，这样的网站被黑客攻击，惨杂涉黄违法页面，导致网站权重下降，最终被网信办查处，我痛心疾首，做过网站的人都清楚这个权重是什么级别。"}]},{"type":"image","attrs":{"id":"188ddaf1-aa36-4883-acb2-50d3bf1ade8f","src":"https://developer.qcloudimg.com/http-save/audit-1095496/d85a7f81ea61e69755143fd89858815a.jpg","extension":"jpg","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":523,"aspectRatio":"0.544792","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"118f630f-fc18-46c7-baaa-43d2a8d703eb","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"今年，我有心做好网站，我服务器某网站周收180个页面的网站又被黑客攻击，导致月收80条，我忍无可忍。因为工作的原因，一直没有及时处理这个问题，但是闲下来了，我就做了排查，并借助AI解决了这个木马，并分享了这篇文章。"}]},{"type":"image","attrs":{"id":"b1a2c21b-a842-4dff-a936-87c5d4759db4","src":"https://developer.qcloudimg.com/http-save/audit-1095496/570492f270ff27af6df845b90f1e3e32.jpg","extension":"jpg","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":550,"aspectRatio":"0.506804","status":"success","showText":true,"isPercentage":true,"percentage":50,"isHoverDragHandle":false}},{"type":"heading","attrs":{"id":"2e2e4420-bf8d-4c96-8b68-cc6cc0a1a822","textAlign":"inherit","indent":0,"level":1,"isHoverDragHandle":false},"content":[{"type":"text","text":"工作开始，一头雾水"}]},{"type":"paragraph","attrs":{"id":"e02d2811-2f35-4cde-b0ce-64aab35b1a60","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"还好有AI的存在，由于我需要尽快解决这个问题，首先我问了豆包，怎么去解决这个问题，它并没有给我比较合适的方案，反正几轮盘查下来，我发现并没有什么用。"}]},{"type":"image","attrs":{"id":"b8ded364-15d6-44aa-ac16-7e96898b7e7e","src":"https://developer.qcloudimg.com/http-save/audit-1095496/f1f0cb788c1b0693952dd87ee32835d0.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":905,"aspectRatio":"1.356822","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"fd6341d0-225a-4824-90e6-1a617a9a607e","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"16a663cf-645d-494b-8e67-39a776f8fff2","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"然后我用workbuddy做了一个网站安全检测的功能，如图："}]},{"type":"image","attrs":{"id":"16efd981-7974-49fb-9a96-d08f09a661de","src":"https://developer.qcloudimg.com/http-save/audit-1095496/c1d0b261ee4102711f312f8bd7e5161a.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":903,"aspectRatio":"1.458805","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"image","attrs":{"id":"4db1be3c-b82d-4db4-bd14-502d6d1937fc","src":"https://developer.qcloudimg.com/http-save/audit-1095496/58e2178d9c5ff0637765980db7bbece7.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":913,"aspectRatio":"1.413313","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"c2b9a6e1-1a9f-4b2c-a4c3-a86e9a5dfe4d","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"但是据workbuddy分析，网站从源码和安全检测中的信息，并没有发现根本原因，导致网站恶意跳转的情况。"}]},{"type":"heading","attrs":{"id":"667426a8-b391-4a8e-aacd-91163e32c2a4","textAlign":"inherit","indent":0,"level":1,"isHoverDragHandle":false},"content":[{"type":"text","text":"方向不对，努力白费"}]},{"type":"paragraph","attrs":{"id":"82af995e-890d-4af4-b1ff-6ef276f13a86","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"过了若干天，我发现服务器的几个网站都接连中招，都是出现了这个跳转，而且页面一样，重启服务器和检查源码都没有发现问题，那这个时候只能是服务器有问题了。"}]},{"type":"paragraph","attrs":{"id":"4f7e2ca2-b231-428e-a9e4-99c110765b71","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接着我的排查内容就是："}]},{"type":"image","attrs":{"id":"b16c4aa3-f2f4-40e6-b51a-654a5af0ba38","src":"https://developer.qcloudimg.com/http-save/audit-1095496/d7536e08516cc47634db17e564baed78.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":568,"aspectRatio":"1.498681","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"41f9f688-08ef-4dcc-8019-4f4817b8190b","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"因为发现要装nslookup，我问了豆包，豆包说先用 curl 先判断是不是服务端跳转："}]},{"type":"codeBlock","attrs":{"id":"33ee0d4e-7de0-4684-b422-003304179c84","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"2p553","languageByAi":"javascript"},"content":[{"type":"text","text":"curl -A \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\" -I https://xxx.xxx"}]},{"type":"paragraph","attrs":{"id":"bab7c40b-e065-432e-b140-9e3e132a01d3","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"注：其中https://xxx.xxx是我的域名，以下均是，不作备注。"}]},{"type":"paragraph","attrs":{"id":"becced21-00cd-458c-b580-3a022eaa6643","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"然后得到结果后给豆包看："}]},{"type":"image","attrs":{"id":"dc912f77-a958-409a-9bed-3a9645e20071","src":"https://developer.qcloudimg.com/http-save/audit-1095496/3c2c28edf32d1edd499ed0045e633fd1.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":862,"aspectRatio":"5.224242","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"66f12da1-336c-4f2c-ac6e-3e8f639ba401","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接着跟着豆包执行这条，下载页面并检索恶意域名、跳转 JS："}]},{"type":"codeBlock","attrs":{"id":"8917d91d-07dd-499a-aca6-fb7d529a6070","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"curl -A \"Mozilla/5.0 Chrome\" https://xxx.xxx | grep -E \"cvkb2p|olkllw|window\\.location|document\\.location|meta.*refresh|eval\\(|fromCharCode\""}]},{"type":"paragraph","attrs":{"id":"e6947859-01b6-4550-a7d0-891e05949bed","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"各种分析结果说，依旧没问题："}]},{"type":"image","attrs":{"id":"e7fff40f-80f4-4ecc-a26f-50e71753bddf","src":"https://developer.qcloudimg.com/http-save/audit-1095496/f05ee115724d750cab78284e1c114b47.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":873,"aspectRatio":"2.204545","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"34534e0a-116b-4026-a3e2-29b45a5c48f9","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接着，全站递归检索网站目录："}]},{"type":"codeBlock","attrs":{"id":"4ad21c22-454b-431e-af93-1b2902281c47","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"6bu85","languageByAi":"javascript"},"content":[{"type":"text","text":"cd /www/wwwroot/xxx.xxx\n# 搜索恶意域名片段\ngrep -r \"olkllw\" ./ --include=*.php --include=*.js --include=*.html --include=*.htm\ngrep -r \"cvkb2p\" ./ --include=*.php --include=*.js --include=*.html --include=*.htm\n# 搜索混淆特征，很多木马不会直接写完整域名，拆分字符串拼接\ngrep -r \"fromCharCode\" ./ --include=*.php\ngrep -r \"String.fromCharCode\" ./ --include=*.php\ngrep -r \"eval(\" ./ --include=*.php\ngrep -r \"base64_decode\" ./ --include=*.php"}]},{"type":"paragraph","attrs":{"id":"3e2d8b95-c7c1-40dc-b0ae-822e3887ac21","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"依旧没有问题："}]},{"type":"image","attrs":{"id":"d3fbf2e7-2090-43f7-a59f-936b91268da8","src":"https://developer.qcloudimg.com/http-save/audit-1095496/f1f1ea9f9536bfa1cb5dbfcbf97c1580.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":805,"aspectRatio":"2.738095","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"heading","attrs":{"id":"68a80c05-df44-46b0-9b7a-abb5f833ee23","textAlign":"inherit","indent":0,"level":1,"isHoverDragHandle":false},"content":[{"type":"text","text":"真正启航，抓住重心"}]},{"type":"paragraph","attrs":{"id":"e8cb9507-e9d2-4029-a20d-65c099add917","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接下来，我发现豆包是不清楚是什么情况（跟AI对话，表达很重要），然后乱分析："}]},{"type":"image","attrs":{"id":"7af0bc4b-395a-4d14-b743-eb818bfc999d","src":"https://developer.qcloudimg.com/http-save/audit-1095496/f233d834996a068beee300481004b4dd.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":906,"aspectRatio":"1.907368","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"fcccf865-c42c-402e-829e-6b0852899c02","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"大家注意，我这里第一说了具体情况，第二说了我的推测，这个很重要，一个是介绍情况，一个是给出方向。"}]},{"type":"paragraph","attrs":{"id":"5903d3e6-c549-46c9-9fd6-5c5a83d9b9be","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接下来，事情就变得简单了，她给了一些操作步骤："}]},{"type":"image","attrs":{"id":"05e70101-f5d5-49b2-b714-6f8836178128","src":"https://developer.qcloudimg.com/http-save/audit-1095496/633784373078ad97593826cf5223955e.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":858,"aspectRatio":"1.537634","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"66acd8ca-9c65-41fc-967d-a980b4adf75c","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接下来，我把最关键的内容，直接copy下来，供大家学习参考，以便我表述不当，导致大家理解不清晰："}]},{"type":"heading","attrs":{"id":"11edc21f-a69b-4bab-951a-8ed4dfce82a7","textAlign":"inherit","indent":0,"level":2,"isHoverDragHandle":false},"content":[{"type":"text","text":"按顺序排查（宝塔 CentOS）"}]},{"type":"heading","attrs":{"id":"62ccd7e0-6938-4d0a-8cf2-e015da57259b","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"① 先查 Nginx 全局配置（重中之重）"}]},{"type":"paragraph","attrs":{"id":"75da3c63-b3e2-4cef-a19a-902cc411e2fe","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"宝塔 nginx 主配置："},{"type":"text","marks":[{"type":"code"}],"text":"/www/server/nginx/conf/nginx.conf"},{"type":"text","text":" 还有全局包含目录："},{"type":"text","marks":[{"type":"code"}],"text":"/www/server/nginx/conf/include/"},{"type":"text","text":" 以及全局 proxy、过滤 lua 脚本"}]},{"type":"paragraph","attrs":{"id":"2a428931-e95d-4599-8a9e-a4f5cd50d0f5","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"执行命令，全局 nginx 配置里面搜恶意特征："}]},{"type":"codeBlock","attrs":{"id":"0eebd83e-19e1-4a8c-8cad-af49131a9f8c","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"grep -r \"cvkb2p\\|olkllw\\|location.*return\\|rewrite\\|lua\" /www/server/nginx/conf/"}]},{"type":"paragraph","attrs":{"id":"49bae258-ce10-4dc7-b692-820ed8a0ab47","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"另外查找 nginx 有没有被加载恶意 lua 脚本（很多劫持是 lua 实现的，条件注入 JS）"}]},{"type":"codeBlock","attrs":{"id":"ddbabd42-d201-4d88-b687-e590722c3d6b","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"grep -r \"content_by_lua\\|access_by_lua\\|header_filter_by_lua\" /www/server/nginx/conf/"}]},{"type":"blockquote","attrs":{"id":"9a5d0482-f356-450c-a9fd-4b21022cfa06","textAlign":"inherit","isHoverDragHandle":false},"content":[{"type":"paragraph","attrs":{"id":"788de7d3-1283-4ecf-a3ca-1d9d237c9b80","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"恶意 nginx 劫持套路：用 "},{"type":"text","marks":[{"type":"code"}],"text":"body_filter_by_lua"},{"type":"text","text":"，在 http 返回包末尾追加<script>跳转代码；curl 有时候 UA 判断不触发，浏览器访问才注入，正好和你现象吻合！"}]}]},{"type":"paragraph","attrs":{"id":"1b07e82b-5ee4-4f85-a5c7-68c1d53b1356","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"⚠️ 检查宝塔 Nginx 是否被替换 / 加装第三方模块："}]},{"type":"codeBlock","attrs":{"id":"fd8471b6-daa8-4f90-8a29-c0266460dfa8","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"nginx -V"}]},{"type":"paragraph","attrs":{"id":"48d99c92-64be-4527-a7a6-9a671862e26e","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"看编译参数里有没有陌生的模块，非官方宝塔自带的 ngx 模块。"}]},{"type":"heading","attrs":{"id":"028557b0-b86a-45ef-82dc-27bdc60db46b","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"② 检查全局前置注入：nginx 的 response 过滤、第三方 WAF / 防火墙插件"}]},{"type":"paragraph","attrs":{"id":"35db393e-52d0-4a10-b6dd-2d3254c3fc32","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"很多人装了不知名的宝塔 WAF、防护插件、广告插件，插件本身被黑，全局插广告； 去宝塔【软件商店】→【已安装】，看有没有不知名、非官方的 WAF、流量过滤、广告插件，先全部暂停测试。"}]},{"type":"heading","attrs":{"id":"2f0d5a1e-de7f-40b0-8457-e285084e6e7a","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"③ 检查系统预加载、rootkit 类劫持（系统中毒方向）"}]},{"type":"codeBlock","attrs":{"id":"193af1e6-4c59-42b9-9612-5d5ed3a5529a","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"# 检查LD_PRELOAD恶意劫持\necho $LD_PRELOAD\nls /etc/ld.so.preload\ncat /etc/ld.so.preload"}]},{"type":"paragraph","attrs":{"id":"7df2eb6d-1982-483d-bc37-87889230fb28","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"如果 "},{"type":"text","marks":[{"type":"code"}],"text":"/etc/ld.so.preload"},{"type":"text","text":" 里面有陌生 "},{"type":"text","marks":[{"type":"code"}],"text":".so"},{"type":"text","text":" 文件，就是 rootkit 流量劫持，属于系统中毒。"}]},{"type":"codeBlock","attrs":{"id":"825b9d81-ea20-45fa-8b15-b47f4b1380c2","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"# 检查开机自启项、可疑定时任务（黑客用来维持后门）\ncrontab -l\nls /etc/cron.d/\nls /etc/rc.d/rc.local\ncat /etc/rc.local\n"}]},{"type":"codeBlock","attrs":{"id":"b7cabe05-ed5c-4bc5-9213-cb8902effd1a","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"# 检查异常内核模块\nlsmod"}]},{"type":"heading","attrs":{"id":"64b65123-83ee-477c-bf32-3e0c276c710e","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"④ 检查有没有全局代理、iptables / 防火墙流量劫持"}]},{"type":"codeBlock","attrs":{"id":"7a1f6c9e-a336-47dc-88d3-010c48e8e53f","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"iptables -L -n"}]},{"type":"paragraph","attrs":{"id":"7b3f2a67-9ee4-4089-990f-e70b91bf7627","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"看有没有陌生的 REDIRECT、DNAT 规则劫持网页流量。"}]},{"type":"heading","attrs":{"id":"c5d42323-b727-4f4b-b71c-2b16fd1213c3","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"⑤ 检查服务器 hosts"}]},{"type":"codeBlock","attrs":{"id":"18aac1f8-c795-46d5-b9c6-6f3d97af2aa6","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"cat /etc/hosts"}]},{"type":"paragraph","attrs":{"id":"d3993237-bccc-44d1-9aeb-42abd74aa30e","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"好，到这里，就清晰了，发现有一个LD_PRELOAD 劫持（用户态 rootkit）："}]},{"type":"image","attrs":{"id":"995956a6-f393-49c7-98a9-62b2d0a4252d","src":"https://developer.qcloudimg.com/http-save/audit-1095496/fd23fc32a661ef56d9ac5bb4de7e7409.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":905,"aspectRatio":"1.925532","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"heading","attrs":{"id":"2739e256-1332-4b59-81f9-b77b1a14ab8e","textAlign":"inherit","indent":0,"level":1,"isHoverDragHandle":false},"content":[{"type":"text","text":"彻底断根，保证安全"}]},{"type":"paragraph","attrs":{"id":"1dca33ce-b35e-40b7-889d-043458dcf1be","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接下来就要清理和拔根了："}]},{"type":"heading","attrs":{"id":"ea7fc37d-c21e-46e5-a5f2-890b403879f9","textAlign":"inherit","indent":0,"level":2,"isHoverDragHandle":false},"content":[{"type":"text","text":"1. 临时清除劫持（在线临时解除，先验证）"}]},{"type":"blockquote","attrs":{"id":"b5bd8405-8a66-4a89-93b0-e2328be2321a","textAlign":"inherit","isHoverDragHandle":false},"content":[{"type":"paragraph","attrs":{"id":"081c9b6b-fdf1-4abd-8092-2396bfe59d7b","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"ld.so.preload 是全局生效，里面写的 so，所有新启动进程都会加载；已经运行的 nginx 进程还带着这个 so，需要重启 nginx。"}]}]},{"type":"codeBlock","attrs":{"id":"f3b417f1-6760-41e9-a588-32a04709e8e0","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"# 清空预加载配置\necho \"\" > /etc/ld.so.preload\n# 删除恶意库文件\nrm -rf /usr/local/usranalyse/\n# 重启nginx，让旧带劫持的进程退出\nsystemctl restart nginx"}]},{"type":"paragraph","attrs":{"id":"3af6e5c1-ccfd-4683-b184-6b321e44f30a","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"⚠️ 但是！这个木马一定有"},{"type":"text","marks":[{"type":"bold"}],"text":"守护进程 + 定时任务"},{"type":"text","text":"维持复活！ 你看你的 crontab 里面一大堆不明的定时脚本："}]},{"type":"codeBlock","attrs":{"id":"3f16500a-3102-4dc6-9d00-0d4ca849e072","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"*/20 * * * * /www/server/cron/4794a799fb67d361ed0dc4a85cb51106\n*/20 * * * * /www/server/cron/e12fa49d54e93e12cd480fa074f1ba49\n...\n*/5 * * * * /www/server/cron/39f929e57cb00212244d15683db53770"}]},{"type":"paragraph","attrs":{"id":"ba5341c5-33fb-4e7d-9080-88901abc262d","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"这些定时任务就是木马守护程序："},{"type":"text","marks":[{"type":"bold"}],"text":"检测 libusranalyse.so 不存在，就自动重新写入 /etc/ld.so.preload、恢复 so 文件"},{"type":"text","text":"，所以只删 so，不清理定时，过几分钟又会恢复劫持！"}]},{"type":"heading","attrs":{"id":"1bd7d6c8-e943-4f58-ab8c-a0af5f7c4c28","textAlign":"inherit","indent":0,"level":2,"isHoverDragHandle":false},"content":[{"type":"text","text":"2. 清理可疑 crontab"}]},{"type":"codeBlock","attrs":{"id":"b374fcc8-2eed-414e-8ff5-f67e212c85c4","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"# 先备份当前定时任务\ncrontab -l > cron.bak\n# 清空当前root的定时任务\ncrontab -r"}]},{"type":"blockquote","attrs":{"id":"8feb4b5b-89b2-4a1e-8b33-cbf357c0ec6b","textAlign":"inherit","isHoverDragHandle":false},"content":[{"type":"paragraph","attrs":{"id":"985c2dde-19b5-4b08-b453-f3b7cf3b694a","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"清空之后，再检查："}]}]},{"type":"codeBlock","attrs":{"id":"e3b31464-6adf-4418-ac7c-b5847bc5f913","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"crontab -l"}]},{"type":"paragraph","attrs":{"id":"0839d2b5-642e-4dbd-a14c-2aa008e1aefa","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"确认返回空。"}]},{"type":"blockquote","attrs":{"id":"96dbdef0-5105-45a4-a61c-187256793c3a","textAlign":"inherit","isHoverDragHandle":false},"content":[{"type":"paragraph","attrs":{"id":"e48d9c5a-cdd5-4625-86f5-22d40344eba8","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"同时检查 "},{"type":"text","marks":[{"type":"code"}],"text":"/www/server/cron/"},{"type":"text","text":" 下面这些随机命名文件，全部是木马脚本："}]}]},{"type":"codeBlock","attrs":{"id":"a67854ce-19c4-4bf2-8b67-efee0753bf5a","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"ls /www/server/cron/\n# 把这些随机名字文件全部删除\nrm -f /www/server/cron/4794a799fb67d361ed0dc4a85cb51106\nrm -f /www/server/cron/e12fa49d54e93e12cd480fa074f1ba49\nrm -f /www/server/cron/39385ff7fb225ce3943bb324427c5a13\nrm -f /www/server/cron/0ca30d8325d26f760434a9b9f416f197\nrm -f /www/server/cron/a9c8d5bb98c0abb536474feff468a8da\nrm -f /www/server/cron/699ae809694fc9cb687674d18ec92ca3\nrm -f /www/server/cron/85f0ba47db1a750bae483377fe101d0d\nrm -f /www/server/cron/d8b634eeb66ca33e15c4760b446ac1c6\nrm -f /www/server/cron/3ab48c27ec99cb9787749c362afae517\nrm -f /www/server/cron/10657007673739a1bff5db050e6893e2\nrm -f /www/server/cron/0fba96ac99e74926b4973efa5c632d9a\nrm -f /www/server/cron/39f929e57cb00212244d15683db53770"}]},{"type":"heading","attrs":{"id":"1d14d3ac-7e18-4c9c-bf44-7a0a6d2aa6ce","textAlign":"inherit","indent":0,"level":2,"isHoverDragHandle":false},"content":[{"type":"text","text":"3. 排查木马守护进程"}]},{"type":"codeBlock","attrs":{"id":"6c2fe03a-46d6-4e54-a6d7-fd603af61e1f","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"# 查找有没有usranalyse相关进程\nps aux | grep usranalyse\nps aux | grep -E \"libusranalyse|usranalyse\""}]},{"type":"paragraph","attrs":{"id":"5062a5b9-5c7e-4c72-bed7-741d46c485e5","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"如果找到进程，kill 掉。"}]},{"type":"paragraph","attrs":{"id":"b075fbf6-3d00-427b-8dec-c3e97eb7e847","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"我不懂crontab任务怎么查，不懂就问："}]},{"type":"image","attrs":{"id":"1bbe10e9-1886-4d54-a137-cbcb9de3fe06","src":"https://developer.qcloudimg.com/http-save/audit-1095496/bc0a86a3c939fbbe611fcacf27d8cfdd.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":880,"aspectRatio":"3.320755","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"ce6e0454-6889-4784-b43e-fc097fb501b6","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"接着就根据豆包的办法找到了木马守护定时任务："}]},{"type":"image","attrs":{"id":"ebe2cb11-8c4e-43b2-ba23-75e074f44fed","src":"https://developer.qcloudimg.com/http-save/audit-1095496/3fd0749ef72246b5f1c380ec168a5c45.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":1100,"aspectRatio":"3.259861","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"8277e2ba-bbc3-4cfa-a45e-fdc4d53c55b4","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"我们按顺序执行下面命令，"},{"type":"text","marks":[{"type":"bold"}],"text":"一条一条复制执行"},{"type":"text","text":"："}]},{"type":"heading","attrs":{"id":"7d75ed7a-e256-4c2c-8795-3891a70de258","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"第一步：备份（留底，以防万一）"}]},{"type":"codeBlock","attrs":{"id":"71c11278-3a67-4b86-9101-df359c353c9d","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"crontab -l > /root/cron_backup.txt"}]},{"type":"heading","attrs":{"id":"23f66aa0-7e1a-42f7-bca6-17389326d5ea","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"第二步：清空 root 全部定时任务"}]},{"type":"codeBlock","attrs":{"id":"160eb6f7-27e0-4f4b-b99e-c0850f3b712e","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"crontab -r"}]},{"type":"heading","attrs":{"id":"268e6e1b-8961-4146-b0a4-4651c9f14949","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"第三步：验证是否清空成功"}]},{"type":"codeBlock","attrs":{"id":"0dec5b0f-ead3-4472-9663-03c858a7bff5","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"crontab -l"}]},{"type":"paragraph","attrs":{"id":"4ea45302-3856-4a7e-975f-859943492eba","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"正常返回："},{"type":"text","marks":[{"type":"code"}],"text":"no crontab for root"}]},{"type":"heading","attrs":{"id":"20cc0833-549f-4d35-87b8-2efbcc48890a","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"第四步：删除这些木马脚本文件（就是定时任务调用的程序）"}]},{"type":"codeBlock","attrs":{"id":"dce001c4-31a1-4465-bdf1-702e4d203d29","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"rm -f /www/server/cron/4794a799fb67d361ed0dc4a85cb51106\nrm -f /www/server/cron/e12fa49d54e93e12cd480fa074f1ba49\nrm -f /www/server/cron/39385ff7fb225ce3943bb324427c5a13\nrm -f /www/server/cron/0ca30d8325d26f760434a9b9f416f197\nrm -f /www/server/cron/a9c8d5bb98c0abb536474feff468a8da\nrm -f /www/server/cron/699ae809694fc9cb687674d18ec92ca3\nrm -f /www/server/cron/85f0ba47db1a750bae483377fe101d0d\nrm -f /www/server/cron/d8b634eeb66ca33e15c4760b446ac1c6\nrm -f /www/server/cron/3ab48c27ec99cb9787749c362afae517\nrm -f /www/server/cron/10657007673739a1bff5db050e6893e2\nrm -f /www/server/cron/0fba96ac99e74926b4973efa5c632d9a\nrm -f /www/server/cron/39f929e57cb00212244d15683db53770"}]},{"type":"heading","attrs":{"id":"fbabffc2-8c93-448c-b7bd-a6c91eb6046c","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"第五步：处理核心劫持 so（libusranalyse.so）"}]},{"type":"codeBlock","attrs":{"id":"53e16e46-0125-41c1-a182-3b96a75c3074","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"echo \"\" > /etc/ld.so.preload\nrm -rf /usr/local/usranalyse/\nsystemctl restart nginx"}]},{"type":"heading","attrs":{"id":"0b04768f-ec7b-4fee-a17d-3e3b0e7ceae6","textAlign":"inherit","indent":0,"level":3,"isHoverDragHandle":false},"content":[{"type":"text","text":"第六步：检查有没有残留的木马进程"}]},{"type":"codeBlock","attrs":{"id":"4e898ba1-182c-4784-bb39-dbc41a939791","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"","languageByAi":"javascript"},"content":[{"type":"text","text":"ps aux | grep usranalyse"}]},{"type":"paragraph","attrs":{"id":"ebdc675e-eff8-45b0-9e4c-5362c3edbdad","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"如果看到有进程，格式类似 "},{"type":"text","marks":[{"type":"code"}],"text":"./usranalyse"},{"type":"text","text":" 这种，记下 PID，执行 "},{"type":"text","marks":[{"type":"code"}],"text":"kill -9 PID"},{"type":"text","text":" 杀掉。"}]},{"type":"paragraph","attrs":{"id":"c5167729-15a9-4761-94db-076ec7edcec5","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"由于没有进程了，甚至过了很久我也没查到相关进程。"}]},{"type":"image","attrs":{"id":"496ffbc3-ec3e-458f-bdb1-625296404966","src":"https://developer.qcloudimg.com/http-save/audit-1095496/8ffae9664c452b7ccdd37c37dd3252de.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":741,"aspectRatio":"2.744444","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"heading","attrs":{"id":"b0a2355a-e382-4f88-ba5e-82d0977d9f36","textAlign":"inherit","indent":0,"level":1,"isHoverDragHandle":false},"content":[{"type":"text","text":"最终一击，长效防护"}]},{"type":"paragraph","attrs":{"id":"a4186e59-59b1-4797-a0a6-3019bc7258a2","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"但是别掉以轻心，执行这个看看："}]},{"type":"codeBlock","attrs":{"id":"07aafeb5-9683-473d-84ae-aa0b01d38262","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"6psvm","languageByAi":"javascript"},"content":[{"type":"text","text":"crontab -u www -l\ncrontab -u nginx -l"}]},{"type":"image","attrs":{"id":"b949dc7e-4a54-4ef5-b682-981a50e2945a","src":"https://developer.qcloudimg.com/http-save/audit-1095496/608a5b988daec8d9c07ea1ee64176756.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":848,"aspectRatio":"2.243386","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"20f16aed-9ca6-41fd-b21b-83185613bc70","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"执行检查常见挖矿/木马进程名，看看有没有意外的："}]},{"type":"codeBlock","attrs":{"id":"9c02d31c-70a7-4a21-b9e1-549410c14e1f","language":"javascript","theme":"atom-one-dark","runtimes":0,"isHoverDragHandle":false,"key":"4teli","languageByAi":"javascript"},"content":[{"type":"text","text":"ps aux | grep -E \"(kdevtmpfsi|kinsing|xmrig|miner|daemon)\""}]},{"type":"image","attrs":{"id":"eb82a9ff-aa1c-4c82-83db-9d82545c4da3","src":"https://developer.qcloudimg.com/http-save/audit-1095496/8fa3257de4cdfa18c0c2c3552089b89d.png","extension":"png","align":"center","alt":"","showAlt":false,"href":"","boxShadow":"","width":1100,"aspectRatio":"7.811189","status":"success","showText":true,"isPercentage":false,"percentage":0,"isHoverDragHandle":false}},{"type":"paragraph","attrs":{"id":"836f1c26-915f-4409-a1a4-cb5701e200f0","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"依旧没问题，现在，我就放心了！"}]},{"type":"paragraph","attrs":{"id":"f8f88ba0-08eb-469f-b345-7fafdb5a11fa","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"但是"},{"type":"text","marks":[{"type":"textStyle","attrs":{"color":"","background":""}}],"text":"最后还是AI提醒大家："}]},{"type":"paragraph","attrs":{"id":"a31f91b6-e0e0-49c2-b2fe-baaed61390fc","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"就算现在正常，"},{"type":"text","marks":[{"type":"bold"}],"text":"继续观察20～30分钟"},{"type":"text","text":"。"}]},{"type":"bulletList","attrs":{"id":"3c3586cc-602b-4a99-96fe-69c6e741f2b6","isHoverDragHandle":false},"content":[{"type":"listItem","attrs":{"id":"6357276d-35d9-4888-bf44-c84955f7ffb1"},"content":[{"type":"paragraph","attrs":{"id":"471a2541-5d5d-4fe6-99e5-2d880844b989","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"如果一直不恢复跳转：尽快修改 root 密码、宝塔面板密码，做好服务器安全加固（关闭不必要端口、限制 SSH 登录 IP）；"}]}]},{"type":"listItem","attrs":{"id":"ba594d9b-286e-40ae-91d9-2755e92f022f"},"content":[{"type":"paragraph","attrs":{"id":"2282d3e1-1503-4e87-be74-5adf84902b9c","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"如果广告又莫名其妙回来，代表还有别的隐藏后门，这种 rootkit 很难手工清理干净，稳妥方案是备份网站数据后重装系统。"}]}]}]},{"type":"paragraph","attrs":{"id":"ed24826d-5915-4db0-8f33-d5985325fdee","textAlign":"inherit","indent":0,"color":null,"background":null,"isHoverDragHandle":false},"content":[{"type":"text","text":"其实不管是豆包还是WorkBuddy，好的表达和准确的反应，一定能帮您解决问题！"}]}]}